How will blocking CMD help? If users have the right privileges they'll be able to do anything, and blocking CMD won't help. Remove the privileges and whatever programs they run they won't be able to do any damage or access areas they shouldn't be able to.